Extracted

• • Target

    f024586a73077261b0ee10567238721e_JaffaCakes118

  • Size

    362KB

  • MD5

    f024586a73077261b0ee10567238721e

  • SHA1

    914f6564f0e9b3584f4a9aa1aa0bfcff1a144473

  • SHA256

    83b862c68383261ff7494c99cd7b28526e0726210605fdc496bed1ba57bb0dce

  • SHA512

    90564288f8df562bc408ca5de16a04c09ed093700f2a1cde8e5b27a7d8b42c2107bf9e9c6fc5f099180d0396df957c9e9acf06720dce567d9d108c12f0018210

  • SSDEEP

    6144:A7voWpVwXFWXOd7YRehyXShu30V3gY28/TLKh/u4R4s8wicnEHtgYma9L:2WXFWXPwhqhbYF/TLKZ9R4VNgYmap

  Score

  10^/10

  cybergatehawkeyeremotediscoverykeyloggerpersistencespywarestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2